The hunt for the killer behind Monday’s Boston Marathon bombings began within minutes of the attacks. Even as local first responders brought the last of the wounded away (at least three were killed, and 140 injured), evidence recovery teams working under the auspices of the Joint Terrorism Task Force of Boston moved in to seal off the bomb sites from contamination and begin the work of picking through the wreckage for pieces of the explosive devices. In Washington, the FBI and CIA began scouring their intelligence databases for missed clues that the attacks had been imminent. And national signals intelligence assets had “ears up” for any congratulatory chatter by terrorist organizations thought to be planning attacks against the U.S.

Which doesn’t mean the case will be solved quickly. By Monday evening, there was still no claim of responsibility for the attacks, and no indication of a culprit. Even when a suspect does emerge, figuring out whether he had accomplices and who the prime mover was will be an ongoing investigation for local, state and federal authorities. According to the Boston police commissioner, Edward Davis, there had been “no specific intelligence that anything was going to happen” at the marathon. A senior FBI official tells TIME the bureau is starting cold on the case. Former senior Justice department officials agree. “They are starting with the facts of the event,” says Todd Hinnen, former acting Assistant Attorney General for National Security.

The investigation is beginning at the scene of the attack. Blast sites look like chaos: debris and blood and shards of glass. But to forensic experts they are fields of evidence waiting to be collected. Amid the starburst of wreckage, FBI experts can find the spring from a timing mechanism or the signature chemical residue of a particular explosive that caused the blast. In Oklahoma City, the vehicle identification number of the truck used in the 1995 bombing was found on its rear axle amid the debris. In Lockerbie, Scotland, investigators found pieces of a cassette player that had contained plastic explosives that had blown Pan Am flight 103 from the sky in 1988.

Officials are looking for help from witnesses, urging them to call in any possible clues to 1-800-494-TIPS. Local officials are also reviewing video from marathon spectators and from local surveillance cameras. “They’re going to be cycling through tape to see if they can identify the packages that were against the side of the building,” says Roger Cressey, a former White House counterterrorism official in the Clinton and Bush administrations.

The investigation will spread from the blast zone out, as other agencies pursue their own pieces of the puzzle. Boston police and FBI will search for and question informants and other human sources to see if groups suspected of violence talked about the attack before or after it occurred. The FBI will search its databases for clues they might have missed in the run up to the bombings. “They’re going back and scrubbing all of their current intelligence holdings for anything that might have had anything to do with this,” says Hinnen.

The further the investigation gets, the more decisions about how to prosecute the case will enter into the proceedings. When the first pieces of evidence are analyzed, a key decision will be made at Main Justice in Washington whether to claim it was a domestic or foreign terrorist attack. If the Attorney General or his deputy decides there is probable cause the attack was foreign planned, investigators will have access to a broad range of authorities available under the Foreign Intelligence Surveillance Act. If it is thought to be a domestic attack, investigations will proceed under more limited authorities, like title three wiretapping or the Patriot Act’s surveillance and evidence gathering powers.

When a suspect emerges, investigators will have another set of calls to make. If they get a suspect quickly, they can claim there is still an imminent threat of other attacks and can question him without reading him his Miranda rights under the Quarels exception for public safety. In the case of Omar Farouk Abdulmutallab, the Underwear Bomber, investigators interrogated the Nigerian native for several hours before he was given medical treatment in an attempt to find out if there were any other plots underway.

Even if it it is days before a suspect is identified, when one is arrested Washington will likely deploy the mobile interrogation teams that were established early in the Obama administration as an alternative to military detention and interrogation. Former White House terrorism advisor John Brennan acknowledged in 2011 that one of the high-value detainee interrogation groups was deployed to interrogate the Times Square bomber, Faisal Shahzad. Shahzad eventually pleaded guilty in a Manhattan court to ten federal crimes.

With the FBI starting with few leads, the investigation into the Boston bombing may not move as fast as Americans are used to: foreign terrorist organizations have been quick to take credit for attacks in recent years, but domestic terrorists often don’t seek the spotlight. At a press conference Monday, President Obama declared, “We will find out who did this.” He didn’t say when.